CVE-2023-31176

Insufficient entropy vulnerability could lead to authentication bypass

State: Published
Severity: 7.5 High
Published: Nov 30, 2023
Updated: Oct 16, 2024
Reserved: Apr 24, 2023

Description

An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication.

See product Instruction Manual Appendix A dated 20230830 for more details.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	SEL

Weaknesses

CWE-331 Insufficient Entropy

Affected Products

Product	Versions
SEL-451Schweitzer Engineering Laboratories	R315-V0 to before R315-V4Affected R316-V0 to before R316-V4Affected R317-V0 to before R317-V4Affected R318-V0 to before R318-V5Affected R320-V0 to before R320-V3Affected R321-V0 to before R321-V3Affected R322-V0 to before R322-V3Affected R323-V0 to before R323-V5Affected R324-V0 to before R324-V4Affected R325-V0 to before R325-V3Affected R326-V0 to before R326-V1Affected R327-V0 to before R327-V1Affected

Product

Versions

SEL-451Schweitzer Engineering Laboratories

R315-V0 to before R315-V4Affected
R316-V0 to before R316-V4Affected
R317-V0 to before R317-V4Affected
R318-V0 to before R318-V5Affected
R320-V0 to before R320-V3Affected
R321-V0 to before R321-V3Affected
R322-V0 to before R322-V3Affected
R323-V0 to before R323-V5Affected
R324-V0 to before R324-V4Affected
R325-V0 to before R325-V3Affected
R326-V0 to before R326-V1Affected
R327-V0 to before R327-V1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.